CVE-2025-38415: Linux Kernel Use-After-Free Vulnerability

CVE-2025-38415 Overview

CVE-2025-38415 is a Linux kernel vulnerability in the Squashfs filesystem driver. The flaw exists in squashfs_fill_super() where the return value of sb_min_blocksize() is not validated before use. A race condition between mounting a Squashfs filesystem and issuing a LOOP_SET_BLOCK_SIZE ioctl on the underlying loop device can cause sb_min_blocksize() to return 0. This leads to a shift-out-of-bounds condition in fs/squashfs/block.c when the kernel computes ffz(~msblk->devblksize), producing a shift exponent of 64 on a 64-bit type. The bug was reported by Syzkaller and is tracked as [CWE-787] (Out-of-Bounds Write).

Critical Impact
A local attacker with the ability to mount Squashfs images and manipulate loop devices can trigger memory corruption, potentially leading to denial of service or privilege escalation.

Affected Products

Linux Kernel (multiple stable branches prior to the fixing commits)
Debian Linux 11.0
Distributions shipping vulnerable upstream kernels

Discovery Timeline

2025-07-25 - CVE-2025-38415 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2025-38415

Vulnerability Analysis

The vulnerability resides in the Squashfs superblock initialization path. During squashfs_fill_super(), the kernel executes:

msblk->devblksize = sb_min_blocksize(sb, SQUASHFS_DEVBLK_SIZE);

followed by:

msblk->devblksize_log2 = ffz(~msblk->devblksize);

When sb_min_blocksize() returns 0, msblk->devblksize becomes 0. The subsequent ffz(~0) call returns 64 because all bits in the inverted value are set. This value is later used as a shift exponent against a 64-bit u64 value in fs/squashfs/block.c:195, triggering undefined behavior detected by UBSAN.

Root Cause

The root cause is a missing return-value check on sb_min_blocksize(). This helper can fail when a concurrent ioctl(LOOP_SET_BLOCK_SIZE) on the same /dev/loop0 device changes the block device state during mount. Two threads race: one mounts a Squashfs image while another reconfigures the loop device. The kernel patch adds an explicit check for a 0 return from sb_min_blocksize() and aborts the mount when the condition occurs.

Attack Vector

Exploitation requires local access and the ability to trigger a Squashfs mount alongside LOOP_SET_BLOCK_SIZE operations on the underlying loop device. Environments that grant users permission to mount filesystem images, such as systems with SYS_ADMIN capability in user namespaces, are the primary exposure surface. The out-of-bounds shift can corrupt kernel state during subsequent block I/O operations issued through squashfs_bio_read.

The vulnerability is described in prose because no verified public exploit code is available. Refer to the upstream kernel commit for the authoritative fix.

Detection Methods for CVE-2025-38415

Indicators of Compromise

Kernel log entries containing UBSAN: shift-out-of-bounds in fs/squashfs/block.c:195
Kernel warnings referencing squashfs_bio_read with abnormal block size values
Unexpected mount failures or oops entries tied to Squashfs superblock initialization

Detection Strategies

Monitor kernel ring buffer output (dmesg, journalctl -k) for UBSAN reports referencing Squashfs
Audit process activity for concurrent mount syscalls and ioctl calls with LOOP_SET_BLOCK_SIZE on the same loop device
Track use of unprivileged user namespaces combined with filesystem mount attempts

Monitoring Recommendations

Forward kernel logs to a central logging platform and alert on UBSAN and BUG signatures
Baseline normal loop device usage and flag unexpected block-size reconfiguration ioctls
Review audit logs for mount() syscalls invoking the squashfs filesystem type from non-administrative contexts

How to Mitigate CVE-2025-38415

Immediate Actions Required

Apply the vendor-supplied kernel updates that include the Squashfs sb_min_blocksize() return-value check
Update Debian systems using the fixes announced in Debian LTS Announcement #7 and Debian LTS Announcement #8
Restrict unprivileged user namespaces and loop-device access on multi-user hosts until patches are deployed

Patch Information

The fix has been backported across multiple stable branches. Reference commits include 734aa853, 0aff95d9, 295ab18c, 4f99357d, 549f9e3d, 5c51aa86, 6abf6b78, and db7096ea. Reboot after installing the updated kernel package.

Workarounds

Disable the Squashfs kernel module (squashfs) on systems that do not require it using modprobe blacklisting
Restrict mount capabilities by disallowing unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 where supported
Limit access to /dev/loop* devices through tightened permissions or udev rules

bash

# Configuration example
echo 'blacklist squashfs' | sudo tee /etc/modprobe.d/blacklist-squashfs.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
sudo chmod 600 /dev/loop-control